Deployment Architecture

Unable to remove member from search head cluster

Lucas_K
Motivator

We need to migrate members in and out of a search head cluster.

It is documented here ( http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/Removeaclustermember ) that the command is "splunk remove shcluster-member" if performed on the host you want removed and "splunk remove shcluster-member -mgmt_uri :" if performed anywhere else.

When I try this all I get is

In handler 'shclustermemberconsensus': Failed to Set Configuration. One potential reason is captain could not hear back from all the nodes in a timeout period. Ensure all to be added nodes are up, and increase the raft timeout. If all nodes are up and running, look at splunkd.log for appendEntries errors due to mgmt_uri mismatch

Looking up that error points towards opening up the timings in server.conf

Setting them to these values below doesn't change the error.

[shclustering]
cxn_timeout_raft = 60
send_timeout_raft = 60
rcv_timeout_raft = 60
rep_cxn_timeout = 60
heartbeat_timeout = 120

Any ideas? splunkd.log gives no clues as to what to do.

ThomasControlwa
Path Finder

hi, so I'm know is it is a late tra to answer, but ig ot the same issue.
in my case I fixed as following.

  • make sure that the member have connection to the deployer, and clustermaster as well.
  • List item
  • for me works : ::remove all "shcluster entries" at SPLUNK_HOME/etc/system/local/server.conf ::rm -rf /SPLUNK_HOME/etc/instance.cfg ::rm -rf /SPLUNK_HOME/var/run/splunk/_raft/* restart splunk, done now you can join or whatever you are looking for

additional links:
https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Handleraftissues
http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Removeaclustermember
http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCconfigurationoverview

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...